Vulnerability · Published Sep 26, 2022 · Assigned by Hitachi

CVE-2021-28052Hitachi Content Platform Information Disclosure Vulnerability

High 7.5

In plain English

A high-severity security flaw in Hitachi Content Platform from Hitachi Vantara. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.8%top 44.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A tenant administrator Hitachi Content Platform (HCP) may modify the configuration in another tenant without authorization, potentially allowing unauthorized access to data in the other tenant. Also, a tenant user (non-administrator) may view configuration in another tenant without authorization. This issue affects: Hitachi Vantara Hitachi Content Platform versions prior to 8.3.7; 9.0.0 versions prior to 9.2.3.

Affected products (as reported)

Vendor	Product	Versions
Hitachi Vantara	Hitachi Content Platform	unspecified – before 8.3.79.0.0 – before 9.2.3

Weakness: CWE-264 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://www.hitachi.com/hirt/hitachi-sec/2021/604.html x_refsource_MISC
https://knowledge.hitachivantara.com/Security/HCP_Multitenancy_Vulnerability x_refsource_MISC